lament/pantheon

fix svcLdapAdmin seed: simpleSecurityObject is what actually grants userPassword #117

Merged

lament merged 1 commit from fix-svcldap-seed into main

2026-07-27 17:50:58 -05:00

lament commented

2026-07-27 17:47:14 -05:00

Owner

the seed's ldapadd for cn=svcLdapAdmin used objectClass: organizationalRole + krbPrincipalAux only - neither grants userPassword, so the follow-up ldapmodify hit Object class violation (65): attribute 'userPassword' not allowed and silently no-opped (the seed script swallows failures with || true). caught by a live verification against verdandi: the entry existed but had no userPassword/krbPrincipalName set at all.

adds simpleSecurityObject as a second auxiliary class (same fix svc-ldap already needed for the same reason)
since that class MUSTs userPassword at creation, the {SASL} pointer moves into the initial ldapadd instead of relying on the modify step to set it for the first time
the modify block still re-asserts userPassword + sets krbPrincipalName, unchanged

the seed's ldapadd for cn=svcLdapAdmin used objectClass: organizationalRole + krbPrincipalAux only - neither grants userPassword, so the follow-up ldapmodify hit `Object class violation (65): attribute 'userPassword' not allowed` and silently no-opped (the seed script swallows failures with `|| true`). caught by a live verification against verdandi: the entry existed but had no userPassword/krbPrincipalName set at all. - adds `simpleSecurityObject` as a second auxiliary class (same fix svc-ldap already needed for the same reason) - since that class MUSTs userPassword at creation, the {SASL} pointer moves into the initial ldapadd instead of relying on the modify step to set it for the first time - the modify block still re-asserts userPassword + sets krbPrincipalName, unchanged

lament added 1 commit

2026-07-27 17:47:14 -05:00

fix svcLdapAdmin seed: simpleSecurityObject is what actually grants userPassword

CI / check (pull_request) Successful in 54s

Details

CI / deploy (pull_request) Has been skipped

Details

CI / build (pull_request) Successful in 2m8s

Details

CI / dry-activate (pull_request) Successful in 32s

Details

CI / check (push) Has been skipped